   [existing-map entries]
   (remove #(contains? existing-map (:id %)) entries))
 
+(declare simplify-permissions-for-es)
+
+(defn permset
+  "create a set. elasticsearch may give us a single string, handle that case"
+  [p]
+  (if (string? p)
+    #{p}
+    (set p)))
+
 (defn entry-needs-update?
   "compare es-entry with mq-entry and determine if we need to update it"
   [es-entry mq-entry]
-  (not= (:mtime es-entry) (:mtime mq-entry)))
+  (or (not= (:mtime es-entry) (:mtime mq-entry))
+      (let [mqperm (-> mq-entry :permissions simplify-permissions-for-es)
+            mqperm* (misc/remap permset mqperm)
+            esperm (select-keys es-entry [:allow :deny])
+            esperm* (misc/remap permset esperm)]
+        (not= mqperm* esperm*))))
 
 (defn find-updates
   "compare entries with those in es-file-map and return a seq of

    [{:keys [_type _id fields]}]
    {:id _id
     :type (estype->type _type)
     :mtime (-> fields :lastmodified lastmodified->mtime)}))

(defn enrich-es-entries

              ["dir" "doc"]
              :size 1000000
              :query {:match_all {}}
              :fields ["parent" "lastmodified" "allow_token_document" "deny_token_document"]
              :filter {:term {:parent parent}}))


